Skip to content
OpenAdvisories
Critical ICSA-20-063-04 12 CVEs

Moxa AWK-3131A Series Industrial AP/Bridge/Client

Published Mar 3, 2020 · Updated Mar 3, 2020

Vendor: Moxa Product: AWK-3131A

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain control of the device and remotely execute arbitrary code.

Vulnerabilities 12

  • Critical 9.9
    CVE-2019-5138

    An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131…

  • Critical 9.9
    CVE-2019-5153

    An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Mox…

  • Critical 9.9
    CVE-2019-5162

    An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa A…

  • High 8.8
    CVE-2019-5136

    An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware…

  • High 8.8
    CVE-2019-5140

    An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware versio…

  • High 8.8
    CVE-2019-5141

    An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware versi…

  • High 8.8
    CVE-2019-5143

    An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A …

  • High 8.0
    CVE-2019-5165

    An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware ver…

  • High 7.5
    CVE-2019-5137

    The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic…

  • High 7.5
    CVE-2019-5148

    An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware ver…

  • High 7.2
    CVE-2019-5142

    An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware vers…

  • Medium 6.2
    CVE-2019-5139

    An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firm…

Revision history

  1. #1

    ICSA-20-063-04 Moxa AWK-3131A series industrial APBridgeClient

References